<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: titles]]></title>
    <link>http://securityratty.com/tag/titles</link>
    <description></description>
    <pubDate>Mon, 26 May 2008 04:23:01 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Security firm warns against Olympic spam]]></title>
      <link>http://securityratty.com/article/bcfdf7b736bd81a9da26fde006e8fb19</link>
      <guid>http://securityratty.com/article/bcfdf7b736bd81a9da26fde006e8fb19</guid>
      <description><![CDATA[Beware of e-mails with sensational Olympic subject titles. They will likely contain a form of malware called Storm that infects computer systems, according to enterprise security firm, Secure...]]></description>
      <content:encoded><![CDATA[Beware of e-mails with sensational Olympic subject titles. They will likely contain a form of malware called Storm that infects computer systems, according to enterprise security firm, Secure Computing.]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/infects computer systems">infects computer systems</category>
      <category domain="http://securityratty.com/tag/enterprise security firm">enterprise security firm</category>
      <category domain="http://securityratty.com/tag/e-mails">e-mails</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/form">form</category>
      <category domain="http://securityratty.com/tag/storm">storm</category>
      <category domain="http://securityratty.com/tag/beware">beware</category>
      <source url="http://www.networkworld.com/news/2008/081908-security-firm-warns-against-olympic.html?fsrc=rss-security">Security firm warns against Olympic spam</source>
    </item>
    <item>
      <title><![CDATA[A Change of Plan For Your Spam]]></title>
      <link>http://securityratty.com/article/20c092cee1e4a4187f4915c282e35789</link>
      <guid>http://securityratty.com/article/20c092cee1e4a4187f4915c282e35789</guid>
      <description><![CDATA[Someone really has to reign me in with these titles. Anyway, you may or may not have heard that the CNN spam mails have now morphed into mails that appear to come from Msnbc.com instead. The titles of...]]></description>
      <content:encoded><![CDATA[
        Someone really has to reign me in with these titles. Anyway, you may or may not have heard that the <a href="http://blog.spywareguide.com/2008/08/cnn-daily-top-10-videos-spam.html">CNN spam mails</a> have now morphed into mails that appear to come from Msnbc.com instead. The titles of the emails are still as insane as ever:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="msb1.jpg" src="http://blog.spywareguide.com/images/msb1.jpg" class="mt-image-none" style="" height="37" width="395" /></span></div><br /> <div><br />......uh, wow. The email will take you to a fake Flash download, just like the previous efforts:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/msb2.html" onclick="window.open('http://blog.spywareguide.com/images/msb2.html','popup','width=949,height=534,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/msb2-thumb-349x196.jpg" alt="msb2.jpg" class="mt-image-none" style="" height="196" width="349" /></a></span><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />Obviously, they haven't gotten around to making fake Msnbc pages so for now we're still stuck with the fake CNN pages.<br /><br />An odd side-effect of these emails is that they're likely lowering subscriber numbers for CNN and Msnbc, because the emails contain genuine unsubscribe links at the bottom:<br /><br /><div align="left"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="msb3.jpg" src="http://blog.spywareguide.com/images/msb3.jpg" class="mt-image-none" style="" height="209" width="555" /></span></div><br /></div><div><br />I doubt the creators of these scam mails intended that - they're just wanting to make the mails look realistic - but I could imagine disgruntled subscribers wondering why CNN and Msnbc keep sending them these things then reaching for the "no more, please!" link...<br /></div>
        
    ]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 11:42:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cnn spam mails">cnn spam mails</category>
      <category domain="http://securityratty.com/tag/mails">mails</category>
      <category domain="http://securityratty.com/tag/cnn">cnn</category>
      <category domain="http://securityratty.com/tag/fake cnn pages">fake cnn pages</category>
      <category domain="http://securityratty.com/tag/msnbc">msnbc</category>
      <category domain="http://securityratty.com/tag/fake msnbc pages">fake msnbc pages</category>
      <category domain="http://securityratty.com/tag/scam mails">scam mails</category>
      <category domain="http://securityratty.com/tag/genuine unsubscribe links">genuine unsubscribe links</category>
      <category domain="http://securityratty.com/tag/fake flash download">fake flash download</category>
      <source url="http://blog.spywareguide.com/2008/08/a-change-of-plan-for-your-spam.html">A Change of Plan For Your Spam</source>
    </item>
    <item>
      <title><![CDATA[CNN Daily Top 10 Videos Spam]]></title>
      <link>http://securityratty.com/article/435bec0379e65b99a3730188a6084946</link>
      <guid>http://securityratty.com/article/435bec0379e65b99a3730188a6084946</guid>
      <description><![CDATA[Like me, you've probably had quite a few &quot;CNN Top 10&quot; emails through over the last day or so. Here's just two of the many, many mails I've had through to various mailboxes





If you opened up any of...]]></description>
      <content:encoded><![CDATA[
        Like me, you've probably had quite a few "CNN Top 10" emails through over the last day or so. Here's just two of the many, many mails I've had through to various mailboxes:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="top101.jpg" src="http://blog.spywareguide.com/images/top101.jpg" class="mt-image-none" style="" height="72" width="371" /></span></div><br /> <div><br />If you opened up any of the mails, you'd have seen this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/top102.html" onclick="window.open('http://blog.spywareguide.com/images/top102.html','popup','width=769,height=385,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/top102-thumb-369x184.jpg" alt="top102.jpg" class="mt-image-none" style="" height="184" width="369" /></a></span></div><br /></div><div><div align="center">Click to Enlarge<br /></div><br />The first clue that something might have been amiss is the strangeness of some of the titles ("Michael Jackson sued by his own dog" isn't something I'd expect to see on CNN, at least not yet). Of course, the giveaway is that regardless of what link you click on, each one takes you to a website that isn't CNN.com - in fact, they all point to the same "video".<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/top103.html" onclick="window.open('http://blog.spywareguide.com/images/top103.html','popup','width=512,height=480,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/top103-thumb-312x292.jpg" alt="top103.jpg" class="mt-image-none" style="" height="292" width="312" /></a></span></div><div align="center"><br /></div></div><div><div align="center">Click to Enlarge<br /></div><br />If you download and install the file offered up, horrible things will start happening to your PC. Let's put it this way - anyone expecting to see Michael Jacksons dog in a courtroom is going to be severely disappointed.<br /><br />Before long, your desktop will look like this:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/top105.html" onclick="window.open('http://blog.spywareguide.com/images/top105.html','popup','width=673,height=374,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/top105-thumb-373x207.jpg" alt="top105.jpg" class="mt-image-none" style="" height="207" width="373" /></a></span><br /><br />Click to Enlarge<br /></div><br />You'll have warnings like these:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="top107.jpg" src="http://blog.spywareguide.com/images/top107.jpg" class="mt-image-none" style="" height="97" width="305" /></span></div><br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/top106.html" onclick="window.open('http://blog.spywareguide.com/images/top106.html','popup','width=700,height=540,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><br /></a></span>And a rogue antivirus product will magically appear on your desktop:<br /><br /><div align="center"><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><a href="http://blog.spywareguide.com/images/top106.html" onclick="window.open('http://blog.spywareguide.com/images/top106.html','popup','width=700,height=540,scrollbars=no,resizable=no,toolbar=no,directories=no,location=no,menubar=no,status=no,left=0,top=0'); return false"><img src="http://blog.spywareguide.com/images/top106-thumb-300x231.jpg" alt="top106.jpg" class="mt-image-none" style="" height="231" width="300" /></a></span>
<br /><br />Click to Enlarge<br /></div><br />Worst of all, look at the name of one of the fake infections they try to scare the user with. <br /><br />There's subtlety, then there's this:<br /><br /><span class="mt-enclosure mt-enclosure-image" style="display: inline;"><img alt="top108.jpg" src="http://blog.spywareguide.com/images/top108.jpg" class="mt-image-none" style="" height="125" width="509" /></span>
<br /><br />....if you want to avoid your computer contributing to the "terrorist threat", don't open up any emails claiming to contain CNN videos.<br /><br />Even if its Michael Jackson and his dog.<br /><br /><br /></div><div><br /></div>
        
    ]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 14:50:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cnn">cnn</category>
      <category domain="http://securityratty.com/tag/cnn top">cnn top</category>
      <category domain="http://securityratty.com/tag/michael jacksons dog">michael jacksons dog</category>
      <category domain="http://securityratty.com/tag/michael jackson">michael jackson</category>
      <category domain="http://securityratty.com/tag/click">click</category>
      <category domain="http://securityratty.com/tag/dog">dog</category>
      <category domain="http://securityratty.com/tag/michael jackson sued">michael jackson sued</category>
      <category domain="http://securityratty.com/tag/cnn videos">cnn videos</category>
      <category domain="http://securityratty.com/tag/enlarge">enlarge</category>
      <source url="http://blog.spywareguide.com/2008/08/cnn-daily-top-10-videos-spam.html">CNN Daily Top 10 Videos Spam</source>
    </item>
    <item>
      <title><![CDATA[Do we need a farm system in the security industry?]]></title>
      <link>http://securityratty.com/article/9bd54e0c74e4d7f5590217159a48aeec</link>
      <guid>http://securityratty.com/article/9bd54e0c74e4d7f5590217159a48aeec</guid>
      <description><![CDATA[Just read a good article by Lisa Vaas on Computerworld titles &quot;When security staffers fail up&quot;. The article talks about some of the challenges that are faced by companies trying to provide proper...]]></description>
      <content:encoded><![CDATA[<p>Just read a <a href="http://computerworld.com/action/article.do?command=viewArticleBasic&amp;articleId=9104599&amp;pageNumber=4">good article by Lisa Vaas</a> on Computerworld titles "When security staffers fail up". The article talks about some of the challenges that are faced by companies trying to provide proper security. While one of the issues is "bundled badness" which I will talk about later, the bigger problem that Lisa writes about is the profile of our security administrators. It is a familiar story I am afraid. Security people don't do a good job of "humanizing" themselves. Their peers don't understand what they are trying to accomplish and too often we speak in geek terms and try to dictate how people conduct business. As a result we are the "people in the way".<br><br>The next thing Lisa hits on is the obsession with certifications. Too many people think having a CISSP is the be all and end all of security. First of all, you can't hire enough of them and many of them don't have the practical business experience to take it to the next level. Than there is the security "prima donna". They just think they are smarter than everyone else and too many tasks are below them as to elementary. We have all met these types before as well. <br><br>Quickly on the "bundled badness" thing. Lisa rightfully points out that in spite of Mike Rothman's feelings to the contrary, though CIO and CFO types like to buy the bundle and get the jack of all trades suite cheaper than buying best of breeds individually, at the end of the day it is hurting our security. If you are really serious about securing the environment there is a world of difference between buying the bundle of goodness versus best in class tools.<br><br>Ultimately though, what are we to do about getting better security pros in the workplace? Do we need to change the certification process? Should companies have a different profile of who they hire for security positions. Do we need to develop some sort of farm system where security pros can cut their teeth and learn their craft, like the guilds and apprentices of yesteryear? The construction industry used to work like that. Maybe we should consider it too?</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=bEHJbL"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=bEHJbL" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=mx99tJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=mx99tJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=e6dpaJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=e6dpaJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=YwE32J"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=YwE32J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Io9IaJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Io9IaJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=qFI7Kj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=qFI7Kj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=TYeLwj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=TYeLwj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/341925149" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 21 Jul 2008 12:17:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security administrators">security administrators</category>
      <category domain="http://securityratty.com/tag/security staffers fail">security staffers fail</category>
      <category domain="http://securityratty.com/tag/security positions">security positions</category>
      <category domain="http://securityratty.com/tag/security people">security people</category>
      <category domain="http://securityratty.com/tag/security pros">security pros</category>
      <category domain="http://securityratty.com/tag/lisa hits">lisa hits</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/lisa">lisa</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/341925149/do-we-need-a-fa.html">Do we need a farm system in the security industry?</source>
    </item>
    <item>
      <title><![CDATA[Q&A with Doug McClure: What Makes BSM Successful?]]></title>
      <link>http://securityratty.com/article/ac3c26a14f128a8ecb49f7c474cbb36e</link>
      <guid>http://securityratty.com/article/ac3c26a14f128a8ecb49f7c474cbb36e</guid>
      <description><![CDATA[Yesterday we featured our initial Q&amp;A with Doug McClure , who took some time to answer some strategic questions on BSM Lite. Today, Doug shares his thoughts on BSM and CMDB strategies for companies...]]></description>
      <content:encoded><![CDATA[<p>Yesterday we featured <a href="http://blog.sciencelogic.com/qa-with-doug-mcclure-is-bsm-lite-the-answer/07/2008" target="_blank">our initial Q&amp;A</a> with <a href="http://dougmcclure.net/blog/" target="_blank">Doug McClure</a>, who took some time to answer some strategic questions on BSM Lite. Today, Doug shares his thoughts on BSM and CMDB strategies for companies and how his stint in the U.S. Navy helped shape his future passion for BSM.</p>
<p><strong><em>ScienceLogic:</em></strong> Can you share any of the strategies/advice that you give to companies embarking on their BSM journeys?</p>
<p><strong><em>Doug McClure:</em></strong> Well, first they&#8217;ve got to have a BSM strategy. Nearly all the clients I talk to or hear about wanting to do BSM do not have a BSM strategy. I talk a lot about this on my blog and with clients and it is relevant whether you&#8217;re going to think about &#8220;BSM Lite&#8221; or &#8220;BSM Heavy&#8221; approaches.</p>
<p>Once we have a BSM strategy, we need to establish a BSM roadmap that guides us in how we’ll implement the BSM strategy in a more tactical manner, focusing on short term iterative quick wins and 30-60-90 day projects. For more of my thoughts on BSM strategy and roadmapping, see the following blog posts.</p>
<ul>
<li>
<h3><a href="http://dougmcclure.net/blog/2007/03/elements-of-business-service-management-part-3-getting-business-service-management-on-the-radar-screen/" target="_blank">Elements of Business Service Management Part 3: Getting Business Service Management on the Radar Screen</a></h3>
</li>
<li>
<h3><a href="http://dougmcclure.net/blog/2007/09/elements-of-business-service-management-part-4-what%e2%80%99s-your-business-service-management-strategy/" target="_blank">Elements of Business Service Management Part 4: What’s your Business Service Management Strategy?</a></h3>
</li>
</ul>
<p>As I&#8217;ve alluded to previously, a client first must define and understand what &#8220;BSM Lite&#8221; may mean to them. Don&#8217;t take what the analysts or the vendors pitch for what you should do to achieve BSM or what value you should get from it.</p>
<p>For any type of BSM to be successful, each client must define what BSM means to them and state what they expect to get from BSM. They must make it personal, make it a part of their company culture and elevate it to be as an important initiative as compliance, risk management, SOA, ITIL, or other initiatives may be within the company.</p>
<p>Please don&#8217;t get scared off from this strategy thing. Please don&#8217;t blow this off as something that the secret enterprise architecture council should be doing. If you&#8217;re unable to get an audience in these areas within your company, start within your own sphere of influence.</p>
<p>Your strategy could be as simple as enabling the local operations center to more efficiently classify, triage and resolve problems based on a simple business service or application contextual understanding. Focus on how this changes the game within your environment. Come up with your own metrics and measures to assess the value this has to this organizational use. Trust me, you&#8217;ll need to justify your investment some time in the future.</p>
<p>Another trait of successful BSM implementations is that of the formal monitoring and management tools group has established some sort of database or knowledge repository that enables them to &#8220;manage the business of IT management and monitoring&#8221; if you will. In my opinion, the vendor community has let their clients down significantly in this area. The CMDB may be the correct answer, but most companies just don’t value monitoring enough to demand that this be included in their formal CMDB initiatives.</p>
<p>In my last job, we developed an application that I referred to as the &#8220;Service Management Database&#8221; or &#8220;SMDB&#8221;. Others may call it something else, but in essence, it was the database that captured what was monitored, how it was monitored, who owned it, what business services and applications it supported, the impact an outage or event from it had on the business services or applications, etc.</p>
<p>One key component of this “SMDB” was establishing the relationships of real and synthetic user and transaction monitoring steps to associated servers and applications. This is a significant gap area in many tools and vendor CMDBs.</p>
<p>Clients who have instituted something formal such as this generally have a very good handle on management and monitoring within their environment. Far too many clients do not have adequate monitoring (read visibility) in place to begin their BSM journey.</p>
<p>I&#8217;d strongly recommend a good hard look at how well the client&#8217;s monitoring and management practices are implemented and managed. Simply put, if they don&#8217;t have adequate visibility into how well those business services and applications are performing, you can&#8217;t expect to manage what you can&#8217;t “see” that may be impacting the business, clients, revenue, etc.</p>
<p>Just ask yourself this – can you explicitly state what monitoring is in place for a given business service or application? Can you quantify the impact of a simple event to a business service or application? Can you explain why something is red, yellow, purple or green and what causes it to change from one color to another? If you can’t, your BSM journey will be challenging.</p>
<p>Those with formal CMDB initiatives have their hands full with high risk, long time to value projects to just get a handle with traditional configuration management models. Taking these low level configuration items (CI&#8217;s) and establishing application and service dependencies comes after a lot of work getting through the organizational challenges of getting systems access to populate the CMDB.</p>
<p>I strongly recommend that the formal monitoring and management tools group create an authoritative database that enables them to establish end-to-end visibility into the service and application delivery chain and the impacts it has on the business, customer, etc. This ultimately becomes part of a more realistic federated CMDB within the business.</p>
<p><strong>ScienceLogic:</strong> Can you provide an example of a successful implementation of BSM? Were there specific factors that especially contributed to its success?</p>
<p><strong><em>Doug McClure:</em></strong> I&#8217;ve touched on the highlights of the most successful BSM implementations throughout my previous answers. Clients that have rallied around an organizational change or transformation focusing every team member’s efforts and energy towards ensuring that the business goals and objectives are being met through the delivery of highly available business services and applications.</p>
<p>Far too often the “change” never happens and it’s the “talking heads” that are preaching to the choir about what should be done. Every person on the front line, in the support teams, at the help desk, etc. must understand how they support or impact the business in business terms. Try putting this simple phrase after job titles “Hi, my name is Doug. I’m a Systems Administrator, Supporting the Business”.</p>
<p>That was a mouthful, but simply put, these clients have an impressively instrumented business and IT environment with the right amount of visibility into each area, joined together with an organization that thinks, operates and responds based on their understanding of the business goals and objectives and how these business services and applications enable business success.</p>
<p>The operational model for an organization fully adopting BSM identifies ways to establish a service management mentality across the entire business service and application delivery and support chain. The delivery, operations and support organizations must be incented to manage the services and applications being delivered with this end-to-end context.</p>
<p>A leading, outside the box “service management organization” may include the traditional IT silos but within a matrixed fashion focused on one or more key business services and applications. The &#8220;service management organization&#8221; is then incented to work together, as a team, for the end-to-end delivery and support of these services or applications.</p>
<p>It’s no longer one’s job to just be the systems administrator, database administrator or network engineer, their job is now to support specific business services and applications. They provide the subject matter expertise needed to support the services and applications together, as a team, eliminating the finger pointing or “not my problem” attitudes that exist in the majority of IT organizations today.</p>
<p>Overall, the KISS approach is what will enable BSM of any type (lite, heavy) to be the most successful. If it just feels natural, doesn&#8217;t take any additional effort, clicks or tasks to do then it&#8217;s going to work. BSM should be transparent and not just another buzz word. It&#8217;s not a form that gets filled out or a special process to follow in the run book. It&#8217;s doing the right thing for the business, no matter what the situation, crisis, buzz word or technology initiative of the day is.</p>
<p><strong><em>ScienceLogic:</em></strong> How did you get involved in BSM?</p>
<p><strong><em>Doug McClure:</em></strong> I think the foundations of my service management background and passion were initially established during my service in the US Navy. Today, I relate that experience to what I call BSM for the Military or Mission Services Management (MSM).</p>
<p>We had been taught over and over that extreme attention to the details of the mission at hand (aka &#8220;the business&#8221;) was the number one priority and that all of our technology, services, and applications existed for those Sailors and Marines on the other end (the &#8220;customer&#8221;). I can recall countless instances where mission critical communications services (telephony, orderwires, teletypes, command and control systems, etc.) were impacted in one way or another. It was extremely critical that we understood who was impacted and to what degree so that contingency plans could be activated. We weren’t just talking about lost revenue, poor sales or customer experience; we were talking about human lives and the security of the United States.</p>
<p>It is that military bearing, attention to detail and real world experience that drives me with many of my modern day BSM endeavors. That migration from &#8220;Mission Services Management&#8221; to BSM was honed working for over 10 years working in the Internet Service Provider (ISP) and datacenter, hosting and colocation business.</p>
<p>In those rapid growth businesses during the Internet boom, service differentiation was what &#8220;made you millions&#8221; or paved your way to bankruptcy. The companies I worked for had an extreme passion and focus on ensuring that their services, applications and Internet access products were of the highest quality, highly reliable and just plain better than the competition.</p>
<p>Again, the IT infrastructure, service quality and customer experience relationship was ingrained in all of our heads. It was all hands on deck when Webmail, Internet access, DNS, or the network experienced problems. We were measured in terms of how many customers experienced a busy signal or dropped connection or if you couldn’t log in fast enough to read your email. Companies like Keynote Systems and LionBridge/Veritest/Inverse tested the quality of our networks, services and applications and publicly ranked us against our competition. We thought in terms of customer experience and impact every minute of the day, 24&#215;7.</p>
<p>It was in my last job managing a traditional enterprise management and monitoring development group for a nationwide ISP where I was able to work with emerging technology to help get a handle on the complexities of these rapidly growing IT environments filled with emerging technologies and products. Applying this early technology to complex service problems in our environment proved to me that the technology, coupled with the right emphasis on how the technology was implemented and an emphasis on the people and processes within the organization could bring BSM to life.</p>
<p>Where I felt left out in the cold was with my vendor relationship. While their technology gave me the potential, they didn&#8217;t teach me how to work through the organizational and technological problems to successfully implement the BSM strategy. My very first end-to-end BSM pilot was extremely successful and provided visibility into the IT environment and business service impact that have never been available before.</p>
<p>And here I am today, working at a software vendor for the first time. Welcome to the &#8220;dark side&#8221; as they say. The approach and methodology we followed for BSM has become the basis of the core BSM Methodology that I teach IBMers and our clients around the world today.</p>
<p>My personal mission and drive here at IBM Tivoli is to ensure that BSM is something that the typical monitoring tools administrator can actually implement and that our BSM story is something that any of our clients can be successful with. The sales and marketing slicks must be backed up by something like this whomever you are these days. Clients shouldn&#8217;t put up for “marketecture”, me too and gee whiz buzz words.</p>
<p>BSM takes a partnership and commitment to every client&#8217;s success, and I want to be involved in those BSM efforts in every industry or market worldwide. We need more thought leaders collaborating together in an open and public forum to change legacy attitudes about BSM and do what we can to enable client’s to be as successful as they can be.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Q%26amp%3BA+with+Doug+McClure%3A+What+Makes+BSM+Successful%3F&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fqa-with-doug-mcclure-what-makes-bsm-successful%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 15:02:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/service management database">service management database</category>
      <category domain="http://securityratty.com/tag/management tools">management tools</category>
      <category domain="http://securityratty.com/tag/service management mentality">service management mentality</category>
      <category domain="http://securityratty.com/tag/business service management">business service management</category>
      <category domain="http://securityratty.com/tag/business service">business service</category>
      <category domain="http://securityratty.com/tag/business service impact">business service impact</category>
      <category domain="http://securityratty.com/tag/mission services management">mission services management</category>
      <category domain="http://securityratty.com/tag/database">database</category>
      <source url="http://blog.sciencelogic.com/qa-with-doug-mcclure-what-makes-bsm-successful/07/2008">Q&amp;A with Doug McClure: What Makes BSM Successful?</source>
    </item>
    <item>
      <title><![CDATA[Errant email exposed Department of Consumer Affairs personal information]]></title>
      <link>http://securityratty.com/article/ca6f5be22b8296dc3dbda7041339d863</link>
      <guid>http://securityratty.com/article/ca6f5be22b8296dc3dbda7041339d863</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/23/08

Organization
State of California

Contractor/Consultant/Branch
Department of Consumer Affairs

Victims
employees, contractors and board members...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/caldca.jpg" width="169" align="right" height="65"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/23/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.ca.gov/">State of California</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.dca.ca.gov/">Department of Consumer Affairs</a><br><br><span style="font-weight: bold;">Victims:</span><br>"employees, contractors and board members"<br><br><span style="font-weight: bold;">Number Affected:</span><br>5,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, Social Security numbers, salaries and job titles<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The state Department of Consumer Affairs (DCA) has sent letters to 5,000 employees, contractors and board members warning them of a security breach that has compromised their names and social security numbers. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.capitolweekly.net/article.php?_adctlid=v%7Cjq2q43wvsl855o%7Cx7o1tt8kp1c3g5&amp;issueId=x79xdv8us2oeyp&amp;xid=x7csom3a3og08k">Capitol Weekly</a> <br><a href="http://www.centralvalleybusinesstimes.com/stories/001/?ID=9111">Central Valley Business Times</a> <br><a href="http://www.pogowasright.org/article.php?story=20080624114400847">Props to PogoWasRight</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Malcolm Maclachlan, Capitol Weekly<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The state Department of Consumer Affairs (DCA) has sent letters to 5,000 employees, contractors and board members warning them of a security breach that has compromised their names and social security numbers.<br><br>About 2,800 of the people on the list are current, full-time employees of the DCA.<br><br>The document also included some former employees and numerous contractors, such as people who proctor state job examinations.<br><br>The rest of the names were employees and board members of the 56 professional boards and bureaus administered by the DCA, such as the Bureau of Automotive Repair and the Medical Board.<br><br>The breach occurred on June 5 or 6 when a Microsoft Word document was improperly transmitted electronically outside of the department, said DCA spokesman Russ Heimerich.<br><br>The document also contained the salaries and titles of everyone on the list, but Heimerich noted that this was public information.<br><br>"The thing that is troubling to us is that information was coupled with their social security numbers," Heimerich said.<br><span style="font-style: italic;">[Evan] Troubling to you?&nbsp; It's probably hard for the victims to have much sympathy.</span><br><br>The main danger with giving away a social security number is that it can be used to set up new credit cards, loans or purchases in someone's name.<br><br>However, a thief would generally need other information that was not included and could be harder to get, such as addresses, phone numbers and driver's license numbers.<br><span style="font-style: italic;">[Evan] Addresses and phone numbers are usually pretty easy to obtain and I would think are much easier to get than Social Security numbers.&nbsp; Unless of course, somebody emails them to you.</span><br><br>The DCA is the main state agency charged with protecting consumers in California.<br><span style="font-style: italic;">[Evan] Ironic.</span><br><br>From 2003 to 2007, it also housed the office charged with educating consumers and businesses about identity theft and fraud.<br><span style="font-style: italic;">[Evan] More Ironic</span><br><br>One agency whose employees were not on the list is the California Office of Privacy Protection (OPP).<br><br>Heimerich said the incident is still being investigated, and that he could not disclose who had received the document.<br><br>He said that so far there is no evidence that any information has been used. It was not even clear the recipient had opened the document.<br><br>"We know that it left the building and that it wound up somewhere it shouldn't have wound up," Heimerich. "We're looking into how that happened."<br><br>“We kind of know where it was sent,” Mr. Heimerich says<br><span style="font-style: italic;">[Evan] Sounds obvious, but did anyone check "Sent Items"?&nbsp; Yeah, probably.&nbsp; Seriously though, does the California DCA not log email sends and receives?&nbsp; It's hard to believe that the sender does not recall to whom they sent the email and there is no evidence of where it was sent.</span><br><br>The breach was discovered on Monday, June 9<br><span style="font-style: italic;">[Evan] It took 3 or 4 days for the DCA to discover the breach.</span><br><br>People's whose names were on the list were sent an email the next day and an official letter a week later.<br><span style="font-style: italic;">[Evan] Excellent quick notification.&nbsp; The earlier that a breach is detected and communicated to the data owner, the better.</span><br><br>Heimerich said the DCA will pay for a year of free credit reports and provide fraud insurance of up to $25,000 for everyone on the list.<br><span style="font-style: italic;">[Evan] One year of protection does not adequately protect information that has a lifespan that far exceeds that one year.&nbsp; Most bad guys (or gals) know that the "standard" organization response to a breach includes one year of free credit monitoring/protection, so many of them wait a year to use the information.&nbsp; It is also important to point out that just because a person monitors their credit, does not mean that their identity isn't being used elsewhere.&nbsp; It's a scary thought, but it's a broken system.</span><br><br>He said the DCA had not yet determined how much these protections were going to cost. <br><span style="font-style: italic;">[Evan] You can estimate the cost yourself.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>I like how Microsoft Outlook helps me when I am typing an email address in the "To:" field of my email.&nbsp; It saves me some keystrokes and a few precious seconds.&nbsp; Sometimes I am in such a hurry that I don't even notice that Outlook put in the wrong email address.&nbsp; I type my email, click send and away I go onto another task.&nbsp; A couple of days later, I get a call from a customer asking where their information is.&nbsp; I state that I sent it to them a couple of days ago, but they claim to have never gotten my email.&nbsp; I look through my sent items, and HOLY #*@^!&nbsp; I just sent some confidential (sensitive and potentially damaging) information to a competitor instead of my customer.<br><br>Sound conceivable?&nbsp; Have you ever sent an embarrassing email to the wrong person?&nbsp; It is very easy to do if your not paying attention.<br><br>There are a number of controls us information security guys can put in place to reduce the risk of this happening.&nbsp; One of the best is information security training and awareness (kind of an administrative control). <br><br><span style="font-weight: bold;">Past Breaches:</span><br><span style="font-weight: bold;">State of California:</span><br>March, 2008 - <a href="http://breachblog.com/2008/03/31/caldoc.aspx">San Quentin visitor and volunteer information lost</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/24/caldca.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 24 Jun 2008 13:51:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/volunteer information lost">volunteer information lost</category>
      <category domain="http://securityratty.com/tag/wrong email address">wrong email address</category>
      <category domain="http://securityratty.com/tag/email address">email address</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/adequately protect information">adequately protect information</category>
      <category domain="http://securityratty.com/tag/credit cards">credit cards</category>
      <category domain="http://securityratty.com/tag/credit">credit</category>
      <source url="http://breachblog.com/2008/06/24/caldca.aspx">Errant email exposed Department of Consumer Affairs personal information</source>
    </item>
    <item>
      <title><![CDATA[Stolen laptop affects thousands of current and former Stanford employees]]></title>
      <link>http://securityratty.com/article/6ccc71f840f261739703c07112ae5cb2</link>
      <guid>http://securityratty.com/article/6ccc71f840f261739703c07112ae5cb2</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/6/08

Organization
Stanford University

Contractor/Consultant/Branch
None

Victims
current and former employees hired before September 28, 2007

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/stanford.jpg" align="right" height="150" width="98"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/6/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.stanford.edu/">Stanford University</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>current and former employees hired before September 28, 2007<br><br><span style="font-weight: bold;">Number Affected:</span><br>as many as 72,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Some or all of the following; First and last name, gender, birthdate, Social Security Number, Business title and office location, Work and home phone numbers, Home address, Salary, Stanford email address, Stanford ID card number and Stanford employee number<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Stanford University determined yesterday that a university laptop, which was recently stolen, contained confidential personnel data. The university is not disclosing details about the theft as an investigation is under way."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://news-service.stanford.edu/news/2008/june11/laprelease-061108.html">Stanford News Service</a> <br><a href="http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/06/08/BAR9115907.DTL">San Francisco Chronicle</a> <br><a href="http://cbs5.com/local/stanford.stolen.laptop.2.742945.html">KPIX Channel 5 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Stanford News Service<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>STANFORD (BCN) ? The personal information of as many as 72,000 people working for, or formerly employed by, Stanford University could be at risk after officials determined a recently stolen laptop contained confidential personnel data.<br><span style="font-style: italic;">[Evan] Even a prestigious school like Stanford University is not immune.&nbsp; 72,000 confidential personal records on a laptop that appears to have not been encrypted is not representative of good information security practice.</span><br><br>The computer contained personal records of Stanford employees hired before Sept. 28, 2007<br><br>data on the laptop included some or all of the following: employees' names, birth dates, Social Security numbers, business titles, work and home phone numbers, home addresses, salaries, and Stanford e-mail addresses and employee identification numbers.<br><br>While the university does not believe the thief was aware of the records' existence on the machine, it is taking steps to assist anyone whose information might be misused.<br><span style="font-style: italic;">[Evan] How many times have we read this in a breach notification?&nbsp; It is almost like a breach notification isn't a breach notification without it.</span><br><br>"We believe that the perpetrator of the crime was not seeking the records on the computer or even aware of them,"<br><br>"Often, such thefts are property crimes in which the laptop's hard drive is erased before the laptop is resold."<br><span style="font-style: italic;">[Evan]&nbsp; Robert Richardson, director of the San Francisco-based Computer Security Institute responds "In the past, if a laptop was stolen from a cafe, it was reasonable to think it would be reformatted and sold as a new machine," "Now I wouldn't make that assumption. Even the dumbest criminals out there are on to the fact that the data is where the money is."&nbsp; I have stated this numerous times on The Breach Blog.&nbsp; Now you don't have to take my word for it.&nbsp; Check out the </span><a style="font-style: italic;" href="http://www.gocsiblog.com/">CSI blog</a><span style="font-style: italic;">.</span><br><br>While there is no evidence that any of the information on the stolen laptop has been accessed, the University is committed to taking steps to assist individuals whose personal data may be misused<br><br>The university is not disclosing the details of the crime, as an investigation is still under way.<br><br>This matter has been reported to law enforcement.<br><br>Stanford sent out an e-mail message Friday to all the current and former employees it could reach, advising them of the theft.<br><br>The university is sending e-mails and letters to current and former employees whose personal information may be at risk, as well as posting information on the Stanford homepage at: <a href="http://www.stanford.edu,">www.stanford.edu,</a> and notifying the media.<br><br>The university said it will provide additional credit monitoring to help employees respond to the possible data breach and protect their identities from fraud.<br><br>"We will have services in place next week and Stanford is committed to assuming this cost,"<br><br>It is also looking at how to protect employee data better in the future.<br><span style="font-style: italic;">[Evan] I hope that mobile device encryption is in the mix.</span><br><br>While the university has rigorous policies and guidelines designed to protect confidential information, events such as this demonstrate the need for heightened vigilance in this area.<br><span style="font-style: italic;">[Evan] Information security always requires a "heightened vigilance".&nbsp; It is a continuous effort.</span><br><br>Vice President for Business Affairs and Chief Financial Officer Randy Livingston will lead a task force to review policies and practices regarding the safety and security of sensitive data.<br><br>Livingston said: "The university has guidelines that prohibit keeping sensitive information on unsecured computers. This effort will be redoubled after this incident."<br><br>We sincerely apologize for this incident.<br><br>You can call (650) 736-0099 and leave your contact information for a return call. You can also go to the Stanford home page for updates or email privacyquestions@stanford.edu with your full name and date of birth.<br><br><span style="font-weight: bold;">Commentary:</span><br>If an organization employs laptops and other mobile devices, it is only a matter of time that one (or more) will be lost or stolen.&nbsp; It is a fact of life, and it really doesn't matter how aware the users are.&nbsp; We either need to make sure that confidential information does not get stored on mobile devices, encrypt them (with secure key management) or preferably both.&nbsp; This is a simplistic view, but you get the point.<br><br>Breaches like this get old, but they still tick me off. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/08/stanford.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 08 Jun 2008 19:12:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stanford">stanford</category>
      <category domain="http://securityratty.com/tag/university laptop">university laptop</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/stanford university">stanford university</category>
      <category domain="http://securityratty.com/tag/stanford email address">stanford email address</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information security practice">information security practice</category>
      <category domain="http://securityratty.com/tag/stanford employee">stanford employee</category>
      <source url="http://breachblog.com/2008/06/08/stanford.aspx">Stolen laptop affects thousands of current and former Stanford employees</source>
    </item>
    <item>
      <title><![CDATA[June Patch Tuesday Advance Notification]]></title>
      <link>http://securityratty.com/article/555c8728a66a50c3b81fac49a35ddad9</link>
      <guid>http://securityratty.com/article/555c8728a66a50c3b81fac49a35ddad9</guid>
      <description><![CDATA[On Tuesday, June 10, Microsoft will release 7 security bulletins, 3 of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very readable...]]></description>
      <content:encoded><![CDATA[On Tuesday, June 10, Microsoft will release 7 security bulletins, 3 of them critical, and security updates to address them.

<a href="http://www.microsoft.com/technet/security/bulletin/ms08-jun.mspx">Microsoft's new advance notification bulletin format</a> adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too:

The three critical bulletins:
<ul>
	<li>The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1</li>
	<li>The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE6 and IE7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008., </li>
	<li>The DirectX Bulletin: Critical on all versions of Windows and DirectX.</li>
</ul>

The other bulletins are entitled WINS, Active Directory, PGM (all ranked Important) and Kill Bit, ranked Moderate.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=e08d9e772790cd852c900f652dab0eb4" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=e08d9e772790cd852c900f652dab0eb4" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/305549057" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 11:49:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security bulletins">security bulletins</category>
      <category domain="http://securityratty.com/tag/bulletins">bulletins</category>
      <category domain="http://securityratty.com/tag/critical bulletins">critical bulletins</category>
      <category domain="http://securityratty.com/tag/windows versions">windows versions</category>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/critical">critical</category>
      <category domain="http://securityratty.com/tag/vista sp1">vista sp1</category>
      <category domain="http://securityratty.com/tag/windows server">windows server</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/305549057/june_patch_tuesday_advance_notification.html">June Patch Tuesday Advance Notification</source>
    </item>
    <item>
      <title><![CDATA[June Patch Tuesday Advance Notification]]></title>
      <link>http://securityratty.com/article/b73bb209c12910b096a7a6b1cff88750</link>
      <guid>http://securityratty.com/article/b73bb209c12910b096a7a6b1cff88750</guid>
      <description><![CDATA[On Tuesday, June 10, Microsoft will release seven security bulletins, three of them critical, and security updates to address them. Microsoft's new advance notification bulletin format adds a very...]]></description>
      <content:encoded><![CDATA[On Tuesday, June 10, Microsoft will release seven security bulletins, three of them critical, and security updates to address them.

<a href="http://www.microsoft.com/technet/security/bulletin/ms08-jun.mspx" target="_blank">Microsoft's new advance notification bulletin format</a> adds a very readable new view in the Affected Software section. For each operating system version you can see which bulletins are relevant and what the severity is. The bulletins now have English titles too:

The three critical bulletins:
<ul><li>The Bluetooth Bulletin: Affects XP SP2 and SP3, Vista and Vista SP1</li>
	<li>The Internet Explorer Bulletin: Affects all Windows versions. Critical on IE 6 and IE 7 on Windows 2000, XP and Vista; Moderate on Windows Server 2003 and 2008</li>
	<li>The DirectX Bulletin: Critical on all versions of Windows and DirectX</li>
</ul>

The other bulletins are for WINS, Active Directory and PGM (all ranked Important) and Kill Bit, ranked Moderate.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=bbca11af77f12f3757d0d85640d39569" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=bbca11af77f12f3757d0d85640d39569" style="display: none;" border="0" height="1" width="1" alt=""/><img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/338277695" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 05 Jun 2008 11:49:31 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security bulletins">security bulletins</category>
      <category domain="http://securityratty.com/tag/bulletins">bulletins</category>
      <category domain="http://securityratty.com/tag/critical bulletins">critical bulletins</category>
      <category domain="http://securityratty.com/tag/windows versions">windows versions</category>
      <category domain="http://securityratty.com/tag/versions">versions</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/critical">critical</category>
      <category domain="http://securityratty.com/tag/vista sp1">vista sp1</category>
      <category domain="http://securityratty.com/tag/windows server">windows server</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/338277695/june_patch_tuesday_advance_notification.html">June Patch Tuesday Advance Notification</source>
    </item>
    <item>
      <title><![CDATA[Web 2.0 Privacy and Security Workshop - Papers Released]]></title>
      <link>http://securityratty.com/article/6c35bbce7010ba98bb940f7cc38395ef</link>
      <guid>http://securityratty.com/article/6c35bbce7010ba98bb940f7cc38395ef</guid>
      <description><![CDATA[Last week, the 2008's W2Sp workshop held in Oakland, California and sponsored by the IEEE Symposium on Security and Privacy , made available all the papers from the workshop, including catchy titles...]]></description>
      <content:encoded><![CDATA[<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://bp3.blogger.com/_wICHhTiQmrA/SDnqguzK7WI/AAAAAAAABvY/5IxC4SeaDbs/s1600-h/web-20.jpg"><img style="margin: 0pt 10px 10px 0pt; float: left; cursor: pointer;" src="http://bp3.blogger.com/_wICHhTiQmrA/SDnqguzK7WI/AAAAAAAABvY/5IxC4SeaDbs/s200/web-20.jpg" alt="" id="BLOGGER_PHOTO_ID_5204448692442688866" border="0" /></a>Last week, the 2008's <a href="http://seclab.cs.rice.edu/w2sp/2008/">W2Sp workshop</a> held in Oakland, California and sponsored by the <a href="http://www.ieee-security.org/TC/SP2008/oakland08.html">IEEE Symposium  on Security and Privacy</a>, made available all the papers from the workshop, including catchy titles such as :<br /><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s1p2.pdf">input type="password" must die!</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s1p1.pdf">Web Authentication by Email Address</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s2p1.pdf">Beware of Finer-Grained Origins</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s2p2.pdf">On the Design of a Web Browser: Lessons learned  from Operating Systems</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s2p3.pdf">Analysis of Hypertext Markup Isolation Techniques  for XSS Prevention</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s3p1.pdf">Privacy Protection for Social Networking  Platforms</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s3p2.pdf">(Under) mining Privacy in Social Networks</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s4p1.pdf">Building Secure Mashups</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s4p2.pdf">Web-key: Mashing with Permission</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/s4p3.pdf">Private Use of Untrusted Web Servers via  Opportunistic Encryption</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/sp1.pdf">Evidence-Based Access Control for Ubiquitous Web  Services</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/sp3.pdf">Privacy Preserving History Mining for Web  Browsers</a><br />- <a href="http://seclab.cs.rice.edu/w2sp/2008/papers/sp5.pdf">Towards Privacy Propagation in the Social  Web</a><br /><br />Information is not free, it just wants to be free.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=NWf5NH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=NWf5NH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=uLbuvH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=uLbuvH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=E7Rsch"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=E7Rsch" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vMEiLh"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vMEiLh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=RcjSTH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=RcjSTH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6xKodH"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6xKodH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=EI59Jh"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=EI59Jh" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/298381897" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 26 May 2008 04:23:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/workshop">workshop</category>
      <category domain="http://securityratty.com/tag/privacy protection">privacy protection</category>
      <category domain="http://securityratty.com/tag/privacy propagation">privacy propagation</category>
      <category domain="http://securityratty.com/tag/social networks">social networks</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/w2sp workshop held">w2sp workshop held</category>
      <category domain="http://securityratty.com/tag/social web">social web</category>
      <category domain="http://securityratty.com/tag/ubiquitous web services">ubiquitous web services</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/298381897/web-20-privacy-and-security-workshop.html">Web 2.0 Privacy and Security Workshop - Papers Released</source>
    </item>
  </channel>
</rss>
